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Abstrac t 

Advanced fighter technologies are evolving into 
highly complex systems. Flight controls are being 
integrated with advanced avionics to achieve a 
total system. The advanced fighter technology 
integration (AFTI) F-16 aircraft is an example of a 
highly complex digital flight control system inte- 
grated with advanced avionics and cockpit. The 
architecture of these new systems involves several 
general issues. The use of dissimilar backup modes 
if the primary system fails requires the designer 
to trade off system simplicity and capability. 

This tradeoff is evident in the AFTI/F-16 aircraft 
with its limited stability and fly-by-wire digital 
flight control systems. In case of a generic soft- 
ware failure, the backup or normal mode must pro- 
vide equivalent envelope protection during the 
transition to degraded flight control. The com- 
plexity of systems like the AFTI/F-16 system 
defines a second design issue, which can be divided 
into two segments: the effect on testing, and the 

pilot's ability to act correctly in the limited 
time available for cockpit decisions. The large 
matrix of states possible with the AFTI/F-16 flight 
control system illustrates the difficulty of both 
testing the system and choosing real-time pilot 
actions. The third generic issue involves possible 
reductions in the users' reliability expectations 
where false single-channel information can be dis- 
played at the pilot-vehicle interface while the 
redundant set remains functional. 

Introduction 

There are numerous design ramifications to the user 
of systems like the advanced fighter technology 
integration (AFTI) F-16 aircraft. Experience with 
the AFTI/F-16 aircraft has illuminated some generic 
requirements for degraded flight control modes, 
cockpit and system architectures. Three architec- 
tural characteristics are discussed in this paper. 
First, AFTI/F-16 flight test results suggest that 
it is important to provide flight-envelope protec- 
tion while transitioning to degraded-mode flight 
control. A second broad implication of experience 
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with the AFTI/F-16 architecture is that complex 
systems are difficult to test before the first 
flight, and they are no less difficult to under- 
stand in real ime. It is possible that cockpits 
based on expert systems may significantly improve 
real-time cockpit decisionmaking. Expert systems 
provide an interactive interface, with computers 
searching lists and pilots identifying situation 
features. The final ramification was exposed by 
having asynchronous architecture and redundant 
channels that could operate alone. Neither archi- 
tectural characteristic, however, should allow 
single-channel interaction at the pilot-vehicle 
interface while redundant channels are still func- 
tional. These broad design implications are 
discussed in terms of delineating relevant system 
mechanization, observing more fundamental architec- 
tural characteristics, and suggesting design 
requirements . 

AFTI/F-16 System 

The AFTI/F-16 aircraft (Fig. 1 ) is a basic F-16 
airframe with a dorsal fairing added to house 
instrumentation, and vertical canards added for 
flight control applications. The avionic and 
flight control systems have been modified exten- 
sively to meet program objectives. 

The digital flight control system (DFCS) for the 
AFTI/F-16 aircraft (Fig. 2) consists of three 
flight control computers, an actuator interface 
unit, a flight control panel, and associated sen- 
sors, controllers, and pilot displays. The flight 
control computers contain the digital hardware 
required to implement the multimode flight control 
software, and a limited analog independent backup 
unit (IBO). The computers are identical and operate 
asynchronously in a frame time approximately 16 msec, 
with some functions operating at 32 Hz and 4 Hz. 

The AFTI DFCS includes the standard F-16 sensors 
and controllers, as well as equipment specific to 
the AFTI/F-16 configuration. A throttle twist grip 
was added to provide decoupled pitch control. 

Pilot displays specific to the AFTI/F-16 aircraft 
were also added. Two multipurpose displays were 
included in the cockpit to provide dual-redundan' 
pilot/vehicle interfacing for weapons management 
and DFCS mode control and status. Extensive flight 
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control system fault information is displayed on 
the multipurpose displays by means of codes indi- 
cating the type and level of failure. 

The software for the computer consists of seven 
computer program components that perform the basic 
software functions of redundancy management, con- 
trol law calculation, and flight control system 
interfacing with the avionics multiplex bus and 
pilot displays. The redundancy management function 
uses three program components : The system monitor 

program module insures that the system is error- 
free before takeoff, and the selector/monitor and 
failure manager provide all in-flight detection, 
isolation, and reconfiguration for faults. The 
redundancy management function provides the dual- 
fail operate capability with the required fault 
detection, isolation, and reconfiguration for the 
sensors, controllers, actuators, and computers, 
which are all monitored in real time during flight. 
Ground built-in test is used by the redundancy 
management function to identify flight control 
hardware failure before flight. 

The control law function consists of control law 
software, which interacts with the input sensors, 
controller, actuation system, and vehicle aerody- 
namics. The AFTI/F-16 is a fly-by-wire aircraft 
that is statically unstable in the pitch axis, 
necessitating a pitch feedback system to provide 
stability. The pitch feedback is an essential 
feature of all AFTI/F-16 modes — cruise conditions 
as well as takeoff and landing. The control laws 
provide eight modes of operation, as shown in 
Table 1. The standard normal mode is used for 
cruise conditions as well as takeoff and landing. 
The standard mode is implemented along with three 
standard task-tailored modes: air-to-air gun, air- 

to-surface gun, and air-to-surf ace bomb. Each of 
these modes also has a decoupled counterpart that 
can be selected using a switch on the side-stick 
controller. The controller and the command option 
implemented in each mode are given in Table 1. The 
decoupled modes provide independent control of spe- 
cific aerodynamic parameters, as shown in Figure 3. 
This highly complex control function relies on the 
redundancy management function to provide valid 
input and output commands . 

De sign Implications 
Degraded Flight Contro l 

The AFTI/F-16 architecture reflects at least three 
design ramifications of general interest. Highly 
augmented aircraft such as the F-16 rely on flight 
control system "intelligence'’ to inhibit aircraft 
responses. Indeed, the flight envelopes of all 
recent fighters are limited by their flight control 
systems. Unstable aircraft obviously require 
closed-loop feedback control to provide conven- 
tional stability and control. Increasing depen- 
dence on the flight control system to provide air- 
craft performance and safety requires classical 
tradeoff decisions when the system is mechanized 
with digital computers. 

Traditionally, software engineers have argued for 
simplicity in the generic software failure recovery 


mechanization. The IBU of the AFTI/F-16 aircraft 
generally follows guidelines for simplicity. In 
fact, the IBU was originally conceived with no 
pitch-rate feedback in the longitudinal axis. Even 
though the AFTI/F-16 aircraft is slightly unstable 
longitudinally, it was initially believed to be 
more important to keep the IBU simple than to mini- 
mize pilot control tasks. The emphasis on simpli- 
city was generally motivated by the desire to maxi- 
mize IBU reliability by minimizing complexity as 
well as the cost of covering a remote failure mode. 
The augmentation required by aircraft like the 
AFTI/F-16 encourages reexamination of the benefit 
of simple, degraded flight control modes such as 
the IBU. 

The AFTI/F-16 aircraft requires angle-of-attack 
limiting to prevent post-departure deep stall. 
Simulation suggests that the IBU provides limited 
capability to recover from spins or deep stalls. 

The automatic yaw-rate limiting of the primary 
flight control system renders the AFTI/F-16 
extremely spin resistant. In the IBU, however, the 
simulation indicates that stopping yaw rate 
requires considerable altitude, thus suggesting a 
smaller envelope may be necessary for safe aircraft 
operation should the aircraft degrade to IBU. A 
similar constraint has been encountered with the 
IBU at high airspeed. During aeroservoelastic 
testing, one pilot found the IBU sufficiently 
unstable laterally at Mach 1.2 that he reselected 
the standard normal mode and did not recommend 
flying faster. Even though the AFTI/F-16 aircraft 
is longitudinally stable supersonically, selecting 
a single fixed gain for fighter aircraft such as 
the AFTI/F-16 over their entire flight envelope may 
not be possible. 

Analytically, there are at least two parts to the 
solution of optimum tradeoff between degraded-mode 
complexity and envelope-protection capability. 

First, consider transitioning from normal to 
degraded flight control. Transitions can be charac- 
terized by discontinuous step inputs or outputs, and 
failures that cause transition to degraded flight 
are usually assumed to be random. The second part 
of degraded-mode flight addresses whether the flight 
can be successfully continued or what constraints 
must be observed during abort and recovery. 

The more difficult decisions occur with respect to 
transition flight. Degraded modes in the AFTI/F-16 
aircraft accommodate discontinuous inputs or out- 
puts satisfactorily, and the techniques are gener- 
ally known. The assumption that one could "drop" 
into IBU at any time, however, presents the possi- 
bility of some adverse events. Transition to IBU 
while flying a maximum angle of attack implies an 
unfortunately high probability of departure. Simi- 
larly, degrading to IBU at high airspeed close to 
the ground suggests that the pilot must attempt to 
slow down while avoiding ground impact in an 
unstable airframe pilot system. Under such cir- 
cumstances the costs of simplicity in modes like 
the IBU are very high during random transitions to 
degraded flight control. Highly augmented aircraft 
such as the AFTI/F-16 are penalized rather severely 
by simplicity in modes like the IBU during the rel- 
atively brief transition period. Development of the 
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IBU reflected several compromises between simplicity 
and adequate coverage; Fig. 4 illustrates the 
significant increase in complexity of the final 
design as compared with the initial design. 
Degraded-mode simplicity is not sufficient justifi- 
cation when it prevents flight-envelope protection 
during the transition to backup flight control. 

After reversion to a backup mode, however, the lack 
of envelope limiting during mission abort is much 
less costly, because the pilot can be asked to con- 
strain the aircraft to more benign conditions. 

For the case of AFTI/F-16 aircraft, angle-of-attack 
limiting would be beneficial, particularly during 
IBU transition. Similarly, if a single fixed gain 
is not sufficient to provide acceptable stability 
over the entire envelope, the backup systems should 
include additional gains. Morever, the primary 
system should automatically update the appropriate 
backup gains for the current dynamic pressure con- 
ditions of the airplane. This provision would 
solve stability problems associated with any fixed- 
gain system to which the aircraft can default at 
any time. It is not necessarily as important for 
the backup system to maintain equivalent envelope 
protection during mission abort and recovery. The 
pilot can be asked to constrain angle of attack to 
safe values during abort. Similarly, he can main- 
tain airspeeds and altitudes appropriate to a 
fixed-gain control mode such as the IBU. It is 
feasible to postulate several gains that a pilot 
could select as he decelerated and descended to 
land. The only constraint to maximizing oppor- 
tunities for simplifying backup systems during the 
recovery phase is that pilot workload or distrac- 
tion may prematurely require a minimum level of 
augmentation during the abort/recovery phase. The 
IBU included pitch-rate feedback in partial 
response to cover pilot workload constraints. 

System C omplexit y 

A second architectural characteristic that signifi- 
cantly affected our experiences reflected the inte- 
grated nature of the system. The AFTI/F-16 is 
complex in terms of the number of system components 
and the permutations on component configuration. 

The large number of system configurations and their 
extensive interaction produce rather subtle conse- 
quences. It is frequently very difficult to expli- 
citly know or test all the system effects of pilot 
actions in the real-time cockpit environment. 
Although the AFTI/F-16 system is not stochastic, it 
is often no more clearly deterministic at the time 
one is trying to anticipate system response to 
pilot-controllable options. System complexity 
impacted both the testing and flying of the 
AFTI/F-16 aircraft. 

The AFTI/F-16 flight control system was extremely 
difficult to test, both for preflight qualification 
and for flight test. This difficulty was caused by 
several factors: the complex system design, the 

asynchronous operation, and the dual-fail operate, 
fault-tolerant design goal. Each of these factors 
individually generates a large test matrix; 
together their interactions generated an extremely 
large test matrix. 


The AFTI/F-16 system contained eight major flight 
control laws having three controller options for 
each control law set with ten reconfiguration 
modes and the ability to combine any of the con- 
troller options in four of the major modes. The 
testing required to assure that all the options 
were operating correctly wa' not accomplished in 
the limited time available; consequently, the 
controller mode combinations were fixed. Combining 
these control laws with the fault-tolerant design 
increased the test matrix. No dual failure was to 
impair mission effectiveness, and no single failure 
was to cause reversion to the independent backup 
mode. The time required to perform the failure- 
modes-and-ef fects testing necessary to assure the 
proper operation in all conditions again exceeded 
the time available, so it also was reduced to the 
basic requirements. Asynchronism added a third 
dimension to test matrices, because any skew con- 
dition between the three channels is possible. 
Unfortunately, this last matrix condition was not 
explicitly addressed during testing (Fig. 5). 

The inability to completely test the system resul- 
ted in many unknowns during flight test. It was 
extremely difficult to reliably predict the total 
system response to a given condition. One major 
cause of the unpredictability was the different 
rates at which the flight control functions were 
processed in (64 Hz, 32 Hz, and 4 Hz). Each of 
these rates can have a worst-case skew condition 
which, when compounded with another rate's skew, 
can cause nuisance software failures that are dif- 
ficult to predict. 

The complex interactions between the control laws 
and asynchronous system operation caused further 
complications during flight test. To provide 
decoupled motion, the control laws provide submodes 
that switch on various input conditions, such as 
rudder pedal out of detent or flaps at their limit 
positions. These submodes were allowed to switch 
asynchronously. As a result, channels operated 
with different sets of control laws, causing Sur- 
face failures, branch failures, or both. This 
switch interaction was not predicted or expected 
before flight test. Skew between channels was 
instrumental in determining whether a failure 
occurred. Because skew conditions are totally ran- 
dom and unpredictable, it was impossible to deter- 
mine exactly when any failure condition would 
occur. The failure conditions caused a design 
change that forced the system to vote the submode 
switch conditions so that all three channels would 
operate in the same submode. 

Because the matrix of possible conditions presents 
such a large and varied set of patterns, providing 
real-time monitoring capability of all possible 
effects is quite difficult. The real-time deter- 
mination of what failure has occurred and its cause 
is an important task for the discipline engineers 
monitoring a flight. A given failure annunciation, 
both in the aircraft and in the control room, can 
have a variety of causes. During flight test, a 
software submode switch resulted in a system 
nuisance failure with conflicting information pre- 
sented on system status. Each channel indicated 
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the other tv/o as failed, resulting in no com- 
munication between channels. At the same time, one 
channel was "talking” on the multiplex bus while 
another was listening, which resulted in a loss of 
the ability of the pilot to know what was occurring 
in the flight control system, as well as a loss of 
reset capability. 

An automated testing system can provide assistance 
in testing complex systems. Many more test cases 
can be examined in the time available if the test- 
ing is performed using a "smart" test system. This 
"smart" test system can perform the specific tests 
and examine their results with much greater ef£i~ 
ciency. The effort required before testing is well 
worth the cost. The greater the complexity of the 
system, the greater the requirement for an automated 
testing system. 

The effects of system complexity on the real-time 
cockpit environment were similar to the difficul- 
ties experienced during preflight testing. A 
second dimension of AFTI/F-16 complexity often 
manifested itself in the cockpit: Several dis- 

cretes were required to indicate a specific com- 
ponent problem, and several components drove the 
same discrete. The AFTI/F-16 employs an architec- 
ture in which a single discrete may indicate 
multiple system conditions and, conversely, several 
discretes are often required to indicate a single 
system configuration or degradation. The multipur- 
pose displays (MPD) are frequently sequential 
interfaces with the flight control system, stores, 
or fire control computers where the pilot's even- 
tual interaction with the system is a function of a 
series of key strokes whose system effects change 
based on the "page" displayed on the MPD at the 
time of option selection. Frequently, a time 
history of failure annunciations is required to 
accurately identify a specific failed component. 

Such a cockpit differs subtly from more traditional 
pilot-vehicle interfaces where system discretes are 
largely dedicated to single, fixed functions. For 
example, failure annunciator lights are usually 
dedicated to single component condition in more 
conventional cockpits. In the AFTI/F-16 cockpit, 
those same lights may be used in combination with 
five-digit numerical fields on the MPD to indicate 
a specific flight control system failure or con- 
figuration. The salient characteristic of a system 
with such configurational flexibility is that cause 
and effect is deduced from a set of multivalued 
system displays that both pass information to the 
pilot and represent pilot commands to the system. 

In the real-time cockpit environment where deci- 
sions are frequently required within a few minutes, 
it is often problematical whether the pilot has the 
information, total system knowledge, or time to 
analyze and consciously acknowledge all ramifica- 
tions of his interaction with the operating system. 
The real-time decisionmaking constraints of systems 
such as the AFTI/F-16 can be addressed by increas- 
the dimensions of the pilot-vehicle interface with 
color presentations, audible tones, and voice actu- 
ation of system discretes. However, the systems 
still rely on the pilot to organize the system 


information, recognize inductive patterns in the 
system status, and deduce logical cause and effect 
relationships. The AFTI/F-16 may provide an early 
opportunity to evaluate "expert systems" in the 
real-time cockpit environment. A pilot-vehicle 
interface constructed around an expert-system archi- 
tecture avails itself of a fundamental symbiosis. 
Human beings are unmatched pattern recognizers. 
Computers, their information structures, and certain 
mathematical algorithms have demonstrated equally 
peerless capability to search extensive graphs, 
trees, and other prestored lists. An expert system 
in the real-time cockpit of an aircraft like the 
AFTI/F-16 promises to use the strength of both pilot 
and computer. Not the least advantage of such a 
system would be its capability to partition deci- 
sions and system information into equivalent sets. 
Such partitioning would allow bounded decisions to 
be made without knowledge of the total system's 
response at the time of decision. Thus, expert 
systems may be powerful aids in solving the type of 
problems faced in the AFTI/F-16 real-time cockpit. 

Simplex Information in Redundant Systems 

A final ramification of system design that has 
proved interesting is the user's percepton of 
system reliability. The design goal of the 
AFTI/F-16 triple-redundant dual-f ail-operate system 
required extraordinarily autonomous channels and a 
very powerful interchannel switching protocol to 
allow degradation to the last good channel. When 
the consequences of asynchronism are summed with 
this intrasystem autonomy, the operating flight 
control system often appears as a series of par- 
tially autonomous components that compete for 
aix-craft control. Much of the interchannel indepen- 
dence arises from both unsynchronized interchannel 
skew and the requisite intrasystem autonomy of a 
triplex dual-f ail-operate system. 

It is important to distinguish the effects of 
asynchronism from last-good-channel operation. The 
AFTX F-16's asynchronous interchannel protocol 
created system states where single channels drive 
discretes and displays at the pilot-vehicle inter- 
face. Such simplex information is most important 
when it issues from the last good channel. 
Asynchronism, however, caused the display of false 
simplex channel information while the redundant set 
was still functional. Such annunciations diminish 
the perception that the system is highly reliable 
because it is composed of multiple identical chan- 
nels — all doing the same "thing" — at least as 
long as there are no "real" faults in the system. 

Unfortunately, the disagreeable impact of this 
architecture on perceptions of reliability causes 
difficulty .in measuring the advantages of the capa- 
bility to degrade to the last good channel and to 
operate asynchronously. Interchannel comparison 
varies between the extremes of bit-by-bit com- 
parison and force summing across the power ram of 
an actuator. Even though AFTI/F-16 computers do 
not explicitly ascertain whether the other members 
of the operating set are performing the same opera- 
tion, program development, nonetheless, shows con- 
tinued localized synchronization. AFTI/F-16 
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channels do not employ dedicated hardware or soft- 
ware to communicate states to redundant channels 
and wait for acknowledgment? they "synchronize" by 
increasing interaction rates# or voting system 
states, or both. Interchannei differences are 
reduced by voting control law switch states, which 
control integrators and gains by interacting suf- 
ficiently fast or by exchanging status information 
in a timely fashion. As long as no errors exist, 
redundant systems cannot function reliably unless 
the implicit interchannei comparisons are suffi- 
ciently small to enable the system to behave as 
identical command paths. This requirement is 
independent of which synchronizing algorithms are 
used to achieve sufficient interchannei tracking. 
Furthermore, those same algorithms should not 
enable simplex information at the pi lot- vehicle 
interface while a redundant set remains. 

A graphic example of how dramatically the percep- 
tion of reliability can suffer from permitting 
simplex information at the pilot-vehicle interface 
while reundant channels remain occurred during 
flight test. Although no failure has occurred, the 
pilot received messages that two of the channels 
had detected each other failed. With each channel 
in a different state, the actuators eventually 
selected a command. The pilot was unable to ascer- 
tain system configuration. It is important to 
recognize that the problem is not that the system 
failed to provide sufficient aircraft control. 

Such inconsistent simplex information erodes users’ 
perceptions that the redundant system is operating 
reliably and v/ill continue to do so in future con- 
fusing failures. 

The AFTX/F-16 incorporates very powerful simplex- 
channel capabilities to enable the system to 
degrade to the last good channel. Although the 
architecture retained this feature, reliability 
requirements forced additional localized inter- 
channei tracking by voting system states and 
increasing interaction rates. Regardless of 
asynchronism, or last-good-channel capability, 
displaying single-channel information with no 
failures in the redundant system diminishes subjec- 
tive estimates of total system reliability. 

Neither architectural characteristic should enable 
single-channel interaction at the pi lot-' vehicle 
interface during redundant channel operation. 

Summa ry 


cles such as the AFTI/F-16. Our experiences have 
illustrated increasingly high penalties associated 
with failing to cover transitions to degraded-mode 
flight. The costs of simplicity for a highly aug- 
mented vehicle are outstripped by costs of aircraft 
requirements for envelope limiting during the 
transition than to degraded flight control. It is 
more important to provide envelope protection during 
transition than to constrain ihe backup system to be 
the simplest system that allows aircraft recovery. 
Aircraft control deteriorates so rapidly with 
unstable airframes that the advantages of backup 
simplicity are quickly overshadowed by risks of air- 
craft loss or severe operational constraints imposed 
to enable safe transition to backup. 

System complex; ty caused a second set of design 
impacts during the testing and flying of the 
AFTI/F-16 aircraft. If a given input set does not 
always generate the same result, it becomes very 
difficult to test. The size of the matrix of tests 
required to fully understand system interactions, 
reconfigurations, and degradations dramatically 
increases with the complexity of the system. A 
system required for a critical task, such as 
fighter flight control, must be predictable and 
understood before it is useful. 

Similarly, the complex nature of the AFTI/F-16 
cockpit suggests rather fundamental constraints, 
which may imply architectures as radical as admit- 
ting expert systems to integrate the pilot-vehicle 
interface. Finally, the capability to degrade to 
the last good channel and asynchronous interchannei 
tracking suggest the advisability of suppressing 
simplex channel information while a redundant set 
remains functional. Just as the actual reliability 
of redundant set operation was improved by localized 
synchronization, the users* perception of system 
reliability is improved by preventing single-channel 
interaction at the pilot-vehicle interface during 
redundant set operation. Experience with the 
AFTI/F-16 system has indicated several interesting 
design ramifications and basic constraints that may 
be useful for future design efforts. 
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Table 1. — AFTI/F-16 Controllers and Command Options 





Controller 


Mode 

Pitch stick 

Roll 

stick 

Rudder pedal 

Throttle twist 




Command 

option 


Standard normal (SNRM) 

Normal acceleration 

Roll 

rate 

Rudder deflection 

None 

Standard air-to-surf ace 

Normal acceleration 

Roll 

rate 

Flat turn 

None 

bombing (SASB) 

Standard air-to-surf ace 

Pitch rate 

Roll 

rate 

Flat turn 

None 

gun (SASG) 

Standard air-to-air gun 

Pitch rate 

Roll 

rate 

Flat turn 

None 

(SAAG) 

Decoupled normal (DNRM) 

Flightpath maneuver 
enhancement 

Roll 

rate 

Translation 

Translation 

Decoupled air-to-surf ace 
bombing (DASB) 

Flightpath maneuver 
enhancement 

Roll 

rate 

Flat turn 

Direct lift 

Decoupled air-to-surf ace 
gun ( DASG) 

Pitch rate maneuver 
enhancement 

Roll 

rate 

Pointing 

Pointing 

Decoupled air-to-air gun 
( DAAG) 

Pitch rate maneuver 
enhancement +• 
flightpath maneu- 
ver enhancement 

Roll 

rate 

Pointing 

Pointing 







Lateral 

accelerometers 


Avionics 

multiplex 

bus 


Fig . 2 Digital flight control system. 
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(a) Vertical translation: vertical (d) Lateral translation : lateral 

velocity control at constant pitch velocity control at constant yaw 

attitude . attitude. 



a 


(b) Direct lift: vertical flightpath 

control at constant angle of attack . 


C e ) Direct sideforce: directional 

flightpath control at zero sideslip 

angle . 




(c) Pitch pointing: pitch attitude ( f ) pointing: directional atti- 

control at constant flightpath angle . tude control at constant flightpath 

angle. 


Fig. 3 Decoupled control . 
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testing, and the pilot's ability to act correctly in the limited time avail- 
able for cockpit decisions. The large matrix of states possible with the 
AFTI/F-16 flight control system illustrates the difficulty of both testing 
the system and choosing real-time pilot actions. The third generic issue 
involves possible reductions in the users* reliability expectations where 
false single-channel information can be displayed at the pilot- vehicle inter- 
face while the redundant set remains functional. 
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